Guidelines to protect client information on phones, laptops released

Canadian law societies are advising lawyers on how to protect their electronic devices when facing border security agents during travel.

The Law Society of Ontario updated its governing board on the issue ahead of a Convocation meeting on April 25. The LSO’s agenda referenced a report developed at the end of last year and presented recently at a semi-annual spring meeting by the Policy Counterpart Group of the Federation of Law Societies of Canada.

In addition to general security tips such as the use of multi-factor authentication, strong passwords and separate accounts or devices for personal and professional matters, the FLSC guidelines also detail steps specifically around protecting solicitor-client privilege.

Although the Canadian Bar Association released a report for Canadians in 2017 on privacy at airports and borders, there hasn’t been clear guidance from the courts on issues such as asking counsel to unlock a phone, says Gerald Chan, a partner at Stockwoods LLP in Toronto.

“The issue comes up when border officers ask counsel or lawyers when they are crossing the borders to disclose the passcode, and the law on whether they can do so and whether that breaches any constitutional rights remains unsettled,” he says.

Firms should create a policy about lawyers and staff who are travelling internationally with smartphones or laptops that contain confidential data, the FLSC report said. The report also says lawyers, notaries and paralegals should discuss protecting privileged information during travel with their clients and include the information in their retainer letter. Some firms go as far as providing separate “clean” laptops and phones for trips or getting their cookies, cache and browsing history “forensically cleaned” by a tech professional, it said.

Privileged documents should be marked and lawyers should carry law society member identification cards and business cards to show border agencies that they are lawyers. That’s especially the case for travellers who are more at risk to be searched: a lawyer that has been in “high-risk” destinations, a single man travelling alone, a lawyer that has multiple devices or hard drives, who bought tickets at the last minute or who has “unusual” travel routes, according to the guidelines, citing research from the B.C. Civil Liberties Association.

The FLSC guidelines say lawyers might consider joining expedited immigration programs such as NEXUS and even opting for a printed itinerary to avoid opening their devices in front of border agents.

There are also specific instructions in the FLSC report on how lawyers should use cloud computing services.

The report advises lawyers to keep phones on airplane mode during the immigration process and to delete cloud-based apps, contacts and calendars before crossing the border.

“[U.S. and Canadian immigration] officers are supposed to look at only information that is on your device, not use the device to access information that is in the cloud,” the FLSC report said.

Joel Sandaluk, a partner at Mamann Sandaluk Kingwell LLP in Toronto, recommends travelling with few privileged documents, bringing personal documents in hard copy and using a phone as a hotspot for travellers who aren’t sure how secure the wireless internet connection is in somewhere such as an airport lounge. He says he has heard anecdotes of rough treatment at the border and clients being asked to reveal notes of meetings with their lawyer. He says lawyers should be prepared to give a clear explanation of their travel plans, with documentation, to border officials to avoid trouble.

“The problem is that the same way that a certain momentum builds up behind positive interactions, a certain type of momentum tends to build up behind negative interactions as well, and those can come back to haunt travellers at subsequent visits to Canada or other countries,” says Sandaluk. “So, one of the things lawyers need to be wary of is that they are not only protecting their own selves and their own documents; they also have to worry about protecting their clients as well. The impact of a negative interaction with a border officer on a vacation could be felt by subsequent clients who you are travelling across the border for in the months or even years to come.”

If a border officer does ask a legal professional for their electronic devices, the FLSC has several tips on how to interact with the border agencies: Speak up early in the process, “request to see the senior customs officer” and “get a receipt and make sure that you have a detailed description of the device including make, model and serial number.”

“Do not be intentionally vague to border officers. Legal counsel should be prepared to explain the purpose of their travel, and if appropriate, their connection to a Canadian law practice, without divulging confidential client information,” the FLSC report says.

The report adds that lawyers themselves may want to consult legal counsel if they anticipate refusing to provide a password to an immigration official. Legal professionals should also be aware of when they have to report the dispute to the law society or other regulatory bodies, according to the report.

“Because the legality of a potential CBSA search of a lawyer or notary’s electronic device

containing privileged information has not been tested in court, legal professionals should be

wary when crossing the border into Canada,” the report says.

The Office of the Privacy Commissioner of Canada agreed that the law on the search of electronic devices was “unsettled” as of December 2018.

“Canadian courts have generally recognized that people have reduced expectations of privacy at border points. In this context, privacy and other Charter rights continue to apply but are limited by state imperatives of national sovereignty, immigration control, taxation and public safety and security,” the privacy commissioner’s office wrote on its website. “The Canadian courts have not yet ruled on whether a border officer can compel a person to turn over their password and on what grounds, so that their electronic device may be searched at a border crossing.”

Although the issue lacks a court test, the FLSC does encourage lawyers to reference or even travel with a copy of correspondence with Ralph Goodale, Canada’s Minister of Public Safety and Emergency Preparedness. Goodale has written to the Standing Committee on Access to Information, Privacy and Ethics and the Law Society of British Columbia on the issue of privileged information on devices at the border and indicated that officers are told not to inspect documents if a legal professional claims privilege.

Nader Hasan, a partner at Stockwoods, says taking precautions can go a long way and might not be as onerous as they seem. For instance, he says, iPhones allow a user to remove a work email address from the settings of the mail app and re-download the contents of the account when you add the email again later. Such a precaution might not stand up to a forensic expert, but it  would hold up to manual search better than “cheater” data-hiding apps — which can actually be red flags for border officers, he says.

“The other thing lawyers should be careful to do is to make sure to assert solicitor-client privilege in the event someone asks to search their phone. It may not prevent the search altogether; however, it is the minimum that we as lawyers can do, to put the state on notice that the device does contain solicitor-client privileged material,” he says, noting that although courts have deferred to border agencies in some cases, he thinks things should become stricter over time.

Chan says that, if it has not already done so, the Canadian Border Security Agency could work with the legal profession to come up with a protocol for dealing with lawyers’ devices.

“I think that’s really necessary — for the CBSA to work together with the legal profession,” he says.